user-instructions-tracker — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited user-instructions-tracker (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Maintain an explicitly authorized durable ledger of cross-task directives while keeping current instruction truth separate from historical fulfillment evidence.
Activation alone never authorizes creating, migrating, or updating a tracker.
Required file:
user-instructions.md at repository rootResolve the active path in this order:
user-instructions.mdskills/user-instructions.mdDo not create a second ledger, copy a legacy ledger, or migrate paths without explicit authorization. Once resolved, use one canonical path for the task.
Record an instruction only when it is intended to survive the current task or conversation, such as:
Do not record ordinary requests, transient implementation details, speculative preferences, or inferred instructions.
Maintain two concepts:
Current Directives: only directives that still govern future workFulfillment History: evidence of what happened under a directive at a point in timeA done historical row proves past fulfillment; it does not prove the instruction is still current.
Directive lifecycle values:
active: current and applicablesuperseded: replaced by a newer directive, with successor identifiedstale: applicability or evidence can no longer be confirmedretired: intentionally no longer applicableAllowed status values:
These values describe fulfillment history, not directive lifecycle:
pendingin_progressblockeddonewon_t_doNever delete or rewrite history to make a superseded directive appear current.
superseded and link its successor.stale rather than guessing.Read Tracker Schema and Lifecycle only when creating an explicitly requested ledger, migrating an authorized legacy ledger, changing lifecycle state, or performing an audit.
Consult canonical skill-catalog.json only when the separately authorized tracker change alters cross-skill routing policy. Regenerate its views through skill-governance/scripts/generate_routing_views.py; do not hand-edit docs/skill-index.md or update routing merely because a directive was recorded.
When a ledger was actually changed, report:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.